Back Api.Msrc.Microsoft

CVE-2026

Api.Msrc.Microsoft • February 10, 2026

Improper neutralization of special elements used in a command ('command injection') in GitHub Copilot and Visual Studio allows an unauthorized attacker to execute code over a network.

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Command Injection Vulnerability in GitHub Copilot and Windows Notepad A command injection vulnerability has been identified in GitHub Copilot, Visual Studio, and the Windows Notepad app, allowing unauthorized attackers to execute code over a network. The issue arises from improper neutralization of special elements used in commands. A proof of concept for CVE-2026-20841 was made public shortly after its publication. 3 sources 14

Extracted Entities

CVE-2026

The full story

Extracted Entities

Attack Types (1)

MITRE ATT&CK (1)

Tools (2)